CVE-2024-0091 is a high severity (CVSS 7.8) untrusted pointer dereference in the NVIDIA GPU Display Driver for Windows and Linux. A local user can trigger it by calling a driver API. NVIDIA fixed it in driver 555.99 and 552.55 on Windows and 555.52.04 and 550.90.07 on Linux, depending on branch.
What's affected
NVIDIA bulletin 5551 lists the affected product as the GPU Display Driver on Windows and Linux, covering GeForce, Studio, RTX, Quadro, NVS and Tesla boards. Fixed versions depend on branch:
- Windows, R555 branch: fixed in 555.99. Windows, R550 branch: fixed in 552.55.
- Linux, R555 branch: fixed in 555.52.04. Linux, R550 branch: fixed in 550.90.07.
The bulletin also covers NVIDIA vGPU software and Cloud Gaming guest and host drivers, each with its own fixed release. It does not list this CVE for the R535 or R470 driver branches in the main driver tables, and it says its tables may not be complete and that earlier releases of a branch might be affected. For a branch with no listed update, it recommends moving to the latest release of a supported branch.
How to check if you're exposed
Read the installed driver version first, then compare it with the table above.
nvidia-smi --query-gpu=driver_version --format=csv,noheader
This works on both Windows and Linux when the driver is loaded. On a hypervisor, also check the vGPU Manager and guest driver versions separately, because the bulletin lists them as distinct components. For a fleet, pull driver versions from your asset inventory rather than checking hosts one at a time.
What to do now
- Record every host with an NVIDIA GPU, including build agents, workstations and GPU servers, and note the driver branch.
- Update drivers to the fixed version for the branch in use, or to the latest release of a supported branch if your branch has no listed fix.
- For virtualised GPUs, update both the Virtual GPU Manager on the host and the guest drivers in the VMs.
- Treat local access as the entry point. Review who can log in to shared GPU machines until patching is done.
- Re-run the version check afterwards and keep the result as evidence.
Why it matters
The NVD record classes this as CWE-822, untrusted pointer dereference. The driver takes a pointer from a caller that it should not trust and uses it. NVIDIA says a successful exploit might lead to denial of service, information disclosure and data tampering. The CVSS vector is local, low complexity, low privileges, no user interaction, with high impact on confidentiality, integrity and availability.
The record does not mark this as exploited in the wild, and it is not in the CISA KEV catalog as of the record. It is still a driver bug reachable by any local user, which makes shared GPU hosts and multi-tenant machines the places to prioritise. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan, and the Gold directory lists the CVE and CWE pages used here.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need network access?
No. The vector is local (AV:L). An attacker needs to be able to run code or call the driver API on the machine.
Is it exploited in the wild?
The record shows KEV as false, and the NVIDIA bulletin fetched for this post does not claim exploitation. Check the bulletin again before relying on that.
Sources
Last reviewed: 19 October 2026.
